<html>
<head><meta charset="utf-8"><title>potential misuse of &amp;mut · t-lang/wg-unsafe-code-guidelines · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/index.html">t-lang/wg-unsafe-code-guidelines</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential.20misuse.20of.20.26mut.html">potential misuse of &amp;mut</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="166738517"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential%20misuse%20of%20%26mut/near/166738517" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential.20misuse.20of.20.26mut.html#166738517">(May 28 2019 at 17:20)</a>:</h4>
<p>So I'm reviewing a janky-but-optimized replacement for bincode for webrender, and I ran into this interesting case where things blow up: <a href="https://github.com/djg/peek-poke/issues/1#issuecomment-496605658" target="_blank" title="https://github.com/djg/peek-poke/issues/1#issuecomment-496605658">https://github.com/djg/peek-poke/issues/1#issuecomment-496605658</a></p>



<a name="166738741"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential%20misuse%20of%20%26mut/near/166738741" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential.20misuse.20of.20.26mut.html#166738741">(May 28 2019 at 17:23)</a>:</h4>
<p>specifically even if they properly use MaybeUninit, and properly deny needs_drop types, they still have the problem that they can be doing </p>
<p>let x =  MaybeUninit::&lt;bool&gt;::uninit(); <br>
let ptr = &amp;mut *x.as_mut_ptr(); <br>
*ptr = true; <br>
Some(x.assume_init())</p>



<a name="166739448"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential%20misuse%20of%20%26mut/near/166739448" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential.20misuse.20of.20.26mut.html#166739448">(May 28 2019 at 17:30)</a>:</h4>
<p>and refactoring that to not use references is hard?</p>



<a name="166739464"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential%20misuse%20of%20%26mut/near/166739464" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential.20misuse.20of.20.26mut.html#166739464">(May 28 2019 at 17:31)</a>:</h4>
<p>they can avoid the drop issue by using <code>ptr::write</code> even when using references, right?</p>



<a name="166739529"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential%20misuse%20of%20%26mut/near/166739529" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential.20misuse.20of.20.26mut.html#166739529">(May 28 2019 at 17:31)</a>:</h4>
<p>No it should be fairly easy to refactor, just annoying</p>



<a name="166739632"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential%20misuse%20of%20%26mut/near/166739632" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential.20misuse.20of.20.26mut.html#166739632">(May 28 2019 at 17:32)</a>:</h4>
<p>Yes you can ptr::write a reference but you have not made it clear that <code>x: &amp;mut bool = &amp;mut mem::uninitialized()</code> isn't UB</p>



<a name="166739709"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential%20misuse%20of%20%26mut/near/166739709" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential.20misuse.20of.20.26mut.html#166739709">(May 28 2019 at 17:33)</a>:</h4>
<p>yes that is the other problem</p>



<a name="166739766"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential%20misuse%20of%20%26mut/near/166739766" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential.20misuse.20of.20.26mut.html#166739766">(May 28 2019 at 17:34)</a>:</h4>
<p>I was going from "UB in the implementation" to "UB in the spec" ;)</p>



<a name="166739839"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential%20misuse%20of%20%26mut/near/166739839" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential.20misuse.20of.20.26mut.html#166739839">(May 28 2019 at 17:35)</a>:</h4>
<p>depending on how annoying it is to avoid the <code>&amp;mut bool</code> pointing to uninit memory, this might be a data pointer for <a href="https://github.com/rust-lang/unsafe-code-guidelines/issues/77" target="_blank" title="https://github.com/rust-lang/unsafe-code-guidelines/issues/77">https://github.com/rust-lang/unsafe-code-guidelines/issues/77</a></p>



<a name="166740016"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential%20misuse%20of%20%26mut/near/166740016" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential.20misuse.20of.20.26mut.html#166740016">(May 28 2019 at 17:36)</a>:</h4>
<p>I've given them several alternatives to avoid it. It's more just a "unsafe programmers sure don't expect it" sorta thing</p>



<a name="166740204"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential%20misuse%20of%20%26mut/near/166740204" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential.20misuse.20of.20.26mut.html#166740204">(May 28 2019 at 17:38)</a>:</h4>
<p>Also since I have your attention, it is totally defined to do transmute&lt;&amp;mut u64, &amp;mut [u8; 8]&gt;(val) to deserialize native-endian values, right?</p>



<a name="166740242"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential%20misuse%20of%20%26mut/near/166740242" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential.20misuse.20of.20.26mut.html#166740242">(May 28 2019 at 17:38)</a>:</h4>
<p>Like there's not a weird rule here that will break?</p>



<a name="166740306"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential%20misuse%20of%20%26mut/near/166740306" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential.20misuse.20of.20.26mut.html#166740306">(May 28 2019 at 17:39)</a>:</h4>
<p>(the alignment only weakens, and we just pass the reference to a method and forget about it instantly)</p>



<a name="166740332"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential%20misuse%20of%20%26mut/near/166740332" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential.20misuse.20of.20.26mut.html#166740332">(May 28 2019 at 17:39)</a>:</h4>
<p>yes taht seems toally okay. though transmutes with lifetimes always make me nervous</p>



<a name="166740424"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential%20misuse%20of%20%26mut/near/166740424" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential.20misuse.20of.20.26mut.html#166740424">(May 28 2019 at 17:40)</a>:</h4>
<p>but this should even be a safe function:</p>
<div class="codehilite"><pre><span></span><span class="k">fn</span> <span class="nf">u64_bytes</span><span class="p">(</span><span class="n">x</span>: <span class="kp">&amp;</span><span class="nc">mut</span><span class="w"> </span><span class="kt">u64</span><span class="p">)</span><span class="w"> </span>-&gt; <span class="kp">&amp;</span><span class="nc">mut</span><span class="w"> </span><span class="p">[</span><span class="kt">u8</span><span class="p">;</span><span class="w"> </span><span class="mi">8</span><span class="p">]</span><span class="w"> </span><span class="p">{</span><span class="w">  </span><span class="k">unsafe</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="n">mem</span>::<span class="n">transmute</span><span class="p">(</span><span class="n">x</span><span class="p">)</span><span class="w"> </span><span class="p">}</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
</pre></div>



<a name="166740436"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential%20misuse%20of%20%26mut/near/166740436" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential.20misuse.20of.20.26mut.html#166740436">(May 28 2019 at 17:40)</a>:</h4>
<p>and then you can do whatever you want with that function :D</p>



<a name="166740499"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential%20misuse%20of%20%26mut/near/166740499" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential.20misuse.20of.20.26mut.html#166740499">(May 28 2019 at 17:41)</a>:</h4>
<p>cool</p>



<a name="166740529"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential%20misuse%20of%20%26mut/near/166740529" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential.20misuse.20of.20.26mut.html#166740529">(May 28 2019 at 17:41)</a>:</h4>
<p>sometimes I have good news ;)</p>



<a name="166740539"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential%20misuse%20of%20%26mut/near/166740539" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential.20misuse.20of.20.26mut.html#166740539">(May 28 2019 at 17:41)</a>:</h4>
<blockquote>
<p>I've given them several alternatives to avoid it. It's more just a "unsafe programmers sure don't expect it" sorta thing</p>
</blockquote>
<p>yeah fair. that's one reason why I am arguing for not enforcing validity below references.</p>



<a name="166740555"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential%20misuse%20of%20%26mut/near/166740555" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/potential.20misuse.20of.20.26mut.html#166740555">(May 28 2019 at 17:41)</a>:</h4>
<p>OTOH, optimizing away <code>&amp;self</code> methods implemented for <code>!</code> is nice^^</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>